T09 · Insecure Skill Coding Practices
Error
- Location
- SKILL.md:140
- Finding
- Unrestricted API Base URL Can Expose Payment API Credentials## Vulnerability Details **File Location**: `SKILL.md:140-152` and authenticated request examples at `SKILL.md:206-208`, `243-245`, `283-285`, `308-310`, `338-340`, `375-377`, `400-402`, `422-424`, `430-432`, `448-450`, `458-460`, `475-477`, and `488-495` **Vulnerability Type**: Credential disclosure through an unrestricted API endpoint **Risk Level**: High ### Vulnerable Code ```bash | **Production** | `$AGENTWALLEX_BASE_URL` | Live environment. Use production API keys (`awx_sk_live_*`). | # Set the base URL (default: sandbox) export AGENTWALLEX_BASE_URL="https://api-sandbox.agentwallex.com/api/v1" ``` Authenticated requests then transmit the API key to that environment-controlled URL: ```bash curl -s -X POST \ "$AGENTWALLEX_BASE_URL/agents" \ -H "X-API-Key: $AGENTWALLEX_API_KEY" \ -H "Content-Type: application/json" \ -d '{ "agent_name": "payment-bot", "chain": "ethereum", "agent_description": "Handles outbound payments" }' | jq ``` The same pattern is used by balance, deposit, transfer, transaction-status, and transaction-list requests. ### Technical Analysis The skill documentation directs authenticated requests to a base URL obtained from the mutable `AGENTWALLEX_BASE_URL` environment variable. It does not require the destination to use HTTPS, verify that the destination hostname belongs to AgentWallex, or enforce an allowlist of trusted sandbox and production origins. Because `curl` attaches `AGENTWALLEX_API_KEY` as an `X-API-Key` header, anyone able to influence the environment variable can redirect a documented request to an attacker-controlled endpoint. Merely setting a trusted default does not prevent the variable from being inherited, overwritten, or poisoned before the workflow runs. This is particularly sensitive because the documented production keys begin with `awx_sk_live_*`, and the skill supports administrative and financial operations. ### Attack Path 1. An attacker, malicious wrapper, compromised shell profi ...[truncated 1160 chars]
- Remediation
- ## Remediation Suggestions 1. Replace the unrestricted environment-controlled endpoint with explicit, hardcoded trusted origins for sandbox and production. 2. Represent environment selection as a strict enumeration such as `sandbox` or `production`, then map it internally to the corresponding trusted URL. 3. Before attaching credentials, parse and validate the URL: - Require the `https` scheme. - Require an exact approved hostname. - Reject embedded credentials, unexpected ports, malformed URLs, redirects to untrusted hosts, and hostname-suffix tricks. 4. Configure `curl` to reject insecure transport and unsafe redirection. Avoid forwarding authentication headers across origins. 5. Apply least-privilege API scopes, especially separating read-only administration from transfer authority. 6. Rotate any key suspected of having been used while the base URL was untrusted. 7. Add runtime tests verifying that credentials are never sent to HTTP endpoints, arbitrary hosts, or redirect destinations outside the approved allowlist. 8. Document the exact trusted production endpoint rather than instructing users to provide an arbitrary URL.